CVE-2026-18329 Overview
CVE-2026-18329 is an authorization bypass vulnerability in the NGINX JavaScript (njs) and QuickJS (qjs) engines. The flaw affects the js_access handler when it performs asynchronous request body processing. If an exception is thrown during asynchronous access-control evaluation before an explicit denial is returned, the js_access phase fails open. An unauthenticated remote attacker can send a crafted HTTP request that triggers this error path and bypass access controls to reach protected resources. The issue is a data plane vulnerability with no control plane exposure. F5 tracks the fix in Security Advisory K000162599.
Critical Impact
A crafted HTTP request can trigger a fail-open condition in the js_access phase, allowing unauthenticated attackers to bypass authorization and access protected NGINX resources.
Affected Products
- NGINX deployments using the JavaScript (njs) engine with a js_access handler
- NGINX deployments using the QuickJS (qjs) engine with a js_access handler
- F5 NGINX products where asynchronous request body processing is enabled in access-control logic
Discovery Timeline
- 2026-09-02 - CVE-2026-18329 published to the National Vulnerability Database (NVD)
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-18329
Vulnerability Analysis
The vulnerability is classified under [CWE-636] (Not Failing Securely, or "failing open"). It resides in the js_access phase handler used by NGINX to enforce access control decisions written in JavaScript. When the handler processes the request body asynchronously, the evaluation path can throw an exception before the script issues an explicit deny decision. Instead of treating the unhandled exception as a denial, NGINX allows the request to proceed to the next phase. Attackers reach protected upstream resources without satisfying authorization logic. Because the flaw is reachable over the network without authentication or user interaction, exploitation can be automated against exposed endpoints.
Root Cause
The root cause is the absence of a safe default in the asynchronous access-control code path. Access decisions must fail closed when an exception aborts evaluation. In the affected njs and qjs engines, exceptions raised during asynchronous body handling in js_access are not converted into a denial. Control returns to the request processing pipeline as if authorization succeeded. This violates the principle of secure failure and produces an authorization bypass whenever the exception path is reachable.
Attack Vector
An unauthenticated attacker sends a crafted HTTP request over the network to an endpoint whose access control is enforced by a js_access handler that reads the request body asynchronously. The request is shaped to trigger an error condition inside the access validation logic during asynchronous evaluation. The exception aborts the deny path, and the request proceeds to the protected resource. No credentials, prior access, or user interaction are required. The specific payload depends on the deployed JavaScript access script and the conditions under which it throws during body processing. See the F5 Security Advisory K000162599 for exact conditions.
Detection Methods for CVE-2026-18329
Indicators of Compromise
- HTTP requests to endpoints protected by js_access that succeed without corresponding authentication events in upstream application logs.
- NGINX error log entries showing JavaScript exceptions or unhandled promise rejections originating from js_access handlers.
- Anomalous request bodies (malformed JSON, unexpected content types, oversized or truncated payloads) targeting endpoints guarded by js_access.
Detection Strategies
- Correlate NGINX access logs with njs and qjs error logs to identify requests that reached protected upstreams while the access handler logged an exception.
- Baseline expected js_access decision outcomes and alert when the ratio of allowed-to-denied requests shifts unexpectedly for a given route.
- Inspect upstream application authorization telemetry for requests that lack the identity or session context normally established by the js_access phase.
Monitoring Recommendations
- Enable verbose logging for js_access handlers, including exception stack traces, and forward logs to a centralized SIEM or data lake.
- Monitor for spikes in 5xx responses or JavaScript engine exceptions on NGINX proxies terminating access-control logic.
- Track outbound requests from NGINX to protected upstreams that originate from unauthenticated clients or unexpected geographies.
How to Mitigate CVE-2026-18329
Immediate Actions Required
- Apply the fixed NGINX, njs, and qjs versions published in F5 Security Advisory K000162599 as soon as they are available for your deployment.
- Inventory all NGINX configurations that use js_access directives and identify handlers that read the request body asynchronously.
- Restrict network exposure of affected endpoints until patches are deployed, using upstream firewalls or IP allowlists.
Patch Information
F5 has published remediation guidance in Security Advisory K000162599. Refer to the advisory for the specific fixed versions of NGINX, njs, and qjs. Software versions that have reached End of Technical Support (EoTS) are not evaluated and should be upgraded to a supported release.
Workarounds
- Rewrite js_access handlers to wrap asynchronous body processing in try/catch blocks and explicitly return a deny decision on any caught exception.
- Move authorization decisions that require request body inspection to the upstream application or a dedicated authorization service that fails closed by default.
- Add a defense-in-depth auth_request or static access control directive in front of js_access so a bypass does not directly expose the protected resource.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
